epriestley a566ae3730 Require a CSRF code for Twitter and JIRA (OAuth 1) logins ... Summary: OAuth1 doesn't have anything like the `state` parameter, and I overlooked that we need to shove one in there somewhere. Append it to the callback URI. This functions like `state` in OAuth2. Without this, an attacker can trick a user into logging into Phabricator with an account the attacker controls. Test Plan: - Logged in with JIRA. - Logged in with Twitter. - Logged in with Facebook (an OAuth2 provider). - Linked a Twitter account. - Linked a Facebook account. - Jiggered codes in URIs and verified that I got the exceptions I expected. Reviewers: btrahan, arice Reviewed By: arice CC: arice, chad, aran Differential Revision: https://secure.phabricator.com/D8318		2014-02-23 16:39:24 -08:00
..
aphront	Convert Phabricator to handle "%s" / "%B" properly	2014-02-23 16:20:46 -08:00
applications	Require a CSRF code for Twitter and JIRA (OAuth 1) logins	2014-02-23 16:39:24 -08:00
docs	Add styles for WARNING and IMPORTANT	2014-01-23 17:35:30 -08:00
extensions	Add src/extensions/ to Phabricator	2013-08-14 15:38:06 -07:00
infrastructure	Convert Phabricator to handle "%s" / "%B" properly	2014-02-23 16:20:46 -08:00
view	Separate reading object values out of didSetObject() in CustomField	2014-02-21 14:44:01 -08:00
__phutil_library_init__.php	Delete license headers from files	2012-11-05 11:16:51 -08:00
__phutil_library_map__.php	Disallow email addresses which will overflow MySQL storage	2014-02-23 10:19:35 -08:00